CVE-2026-23067

An integer signedness bug was found in the Linux kernel's ARM IOMMU page table implementation. The __arm_lpae_unmap() function returns size_t (unsigned) but was returning -ENOENT (negative error code) on error. The negative value becomes a huge positive number (0xFFFFFFFFFFFFFFFE on 64-bit) which propagates through the call chain, causing IOVA address overflow in __iommu_unmap() and triggering a BUG_ON in iommu_pgsize() due to invalid address alignment.

This bug affects ARM-based systems using the LPAE (Large Physical Address Extension) IOMMU page table format. The crash occurs when attempting to unmap an already-unmapped PTE, which can happen during device driver cleanup or error recovery paths. The impact is limited to denial of service through a kernel panic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.